anders/Wallet
1
0
Fork 0
Code Issues Projects Releases Packages Wiki Activity

paypro: improve PaymentRequest verification using the latest bitcore.

Browse source
This commit is contained in:
Christopher Jeffrey 2014-08-28 19:47:15 -07:00
commit 49d362a238
1 changed files with 10 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

20
js/models/core/Wallet.js
View file

@ -1284,21 +1284,13 @@ Wallet.prototype.receivePaymentRequest = function(options, pr, cb) {
}; };
} }
var trusted = certs.map(function(cert) {
var der = cert.toString('hex');
var pem = PayPro.prototype._DERtoPEM(der, 'CERTIFICATE');
return PayPro.RootCerts.getTrusted(pem);
}).filter(Boolean);
// Verify Signature // Verify Signature
var verified = pr.verify(); var trust = pr.verify(true);
if (!verified) { if (!trust.verified) {
return cb(new Error('Server sent a bad signature.')); return cb(new Error('Server sent a bad signature.'));
} }
var ca = trusted[0];
details = PayPro.PaymentDetails.decode(details); details = PayPro.PaymentDetails.decode(details);
var pd = new PayPro(); var pd = new PayPro();
pd = pd.makePaymentDetails(details); pd = pd.makePaymentDetails(details);
@ -1338,8 +1330,9 @@ Wallet.prototype.receivePaymentRequest = function(options, pr, cb) {
merchant_data: merchant_data.toString('hex') merchant_data: merchant_data.toString('hex')
}, },
signature: sig.toString('hex'), signature: sig.toString('hex'),
ca: ca, ca: trust.caName,
untrusted: !ca untrusted: !trust.caTrusted,
selfSigned: trust.selfSigned
}, },
request_url: options.uri, request_url: options.uri,
total: bignum('0', 10).toString(10), total: bignum('0', 10).toString(10),
@ -1703,7 +1696,8 @@ Wallet.prototype.verifyPaymentRequest = function(ntxid) {
pr = pr.makePaymentRequest(data); pr = pr.makePaymentRequest(data);
// Verify the signature so we know this is the real request. // Verify the signature so we know this is the real request.
if (!pr.verify()) { var trust = pr.verify();
if (!trust.verified) {
// Signature does not match cert. It may have // Signature does not match cert. It may have
// been modified by an untrustworthy person. // been modified by an untrustworthy person.
// We should not sign this transaction proposal! // We should not sign this transaction proposal!